Servers and applications
CVE-2018-14847
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 1 Dec 2021.
- Severity
- Critical 9.1
- Published
- 2 Aug 2018
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 96% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 10 Nov 2026
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
MikroTik RouterOSServers and applications · cpe:o:mikrotik:routeros |
|
Known exploited
- CISA name
- MikroTik Router OS Directory Traversal Vulnerability
- Required action
- Apply updates per vendor instructions.
- Due for US agencies
- 1 Jun 2022
- Used in ransomware
- Not known